Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) search_term parameter to main/auth/courses.php; the (2) frm_title and (3) frm_content parameters in a new personal agenda item action; the (4) title and (5) tutor_name parameters in a new course action; and the (6) student and (7) course parameters to main/mySpace/myStudents.php. NOTE: vectors 2 and 3 might only be exploitable via a separate CSRF vulnerability.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Dokeos 多个远程输入验证和跨站脚本攻击漏洞
Vulnerability Description
Dokeos 1.8.5版本及其早期版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助(1)对main/auth/courses.php的search_term参数;(2)frm_title以及(3)一个新的个人事项项目操作中的frm_content参数;(4)标题和(5)一个新进程操作中的tutor_name参数;以及(6)student和(7)对main/mySpace/myStudents.php的course参数，注入任意web脚本或HTML。注意：向量2和3可能在借助一个单独的CSRF漏洞的情况
CVSS Information
N/A
Vulnerability Type
N/A